Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f9443474 authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman
Browse files

Merge 5.4.219 into android11-5.4-lts 



Changes in 5.4.219
	Revert "fs: check FMODE_LSEEK to control internal pipe splicing"
	mac80211: mlme: find auth challenge directly
	wifi: mac80211: don't parse mbssid in assoc response
	wifi: mac80211: fix MBSSID parsing use-after-free
	Linux 5.4.219

Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@google.com>
Change-Id: I23480812b6b0d4527bc81cbc07115eeabe07cc81
parents 4fa407bf fd92cfed

Makefile

+1 −1
Original line number Diff line number Diff line 
# SPDX-License-Identifier: GPL-2.0

VERSION = 5

PATCHLEVEL = 4

SUBLEVEL = 218

SUBLEVEL = 219

EXTRAVERSION =

NAME = Kleptomaniac Octopus

net/mac80211/ieee80211_i.h

+2 −2
Original line number Diff line number Diff line
@@ -1460,7 +1460,6 @@ struct ieee802_11_elems { 
	const u8 *supp_rates;

	const u8 *ds_params;

	const struct ieee80211_tim_ie *tim;

	const u8 *challenge;

	const u8 *rsn;

	const u8 *erp_info;

	const u8 *ext_supp_rates;
@@ -1507,7 +1506,6 @@ struct ieee802_11_elems { 
	u8 ssid_len;

	u8 supp_rates_len;

	u8 tim_len;

	u8 challenge_len;

	u8 rsn_len;

	u8 ext_supp_rates_len;

	u8 wmm_info_len;
@@ -1521,6 +1519,8 @@ struct ieee802_11_elems { 
	u8 country_elem_len;

	u8 bssid_index_len;



	void *nontx_profile;



	/* whether a parse error occurred while retrieving these elements */

	bool parse_error;

};

net/mac80211/mlme.c

+13 −8
Original line number Diff line number Diff line
@@ -2832,14 +2832,14 @@ static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata, 
{

	struct ieee80211_local *local = sdata->local;

	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;

	const struct element *challenge;

	u8 *pos;

	struct ieee802_11_elems elems;

	u32 tx_flags = 0;



	pos = mgmt->u.auth.variable;

	ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems,

			       mgmt->bssid, auth_data->bss->bssid);

	if (!elems.challenge)

	challenge = cfg80211_find_elem(WLAN_EID_CHALLENGE, pos,

				       len - (pos - (u8 *)mgmt));

	if (!challenge)

		return;

	auth_data->expected_transaction = 4;

	drv_mgd_prepare_tx(sdata->local, sdata, 0);
@@ -2847,7 +2847,8 @@ static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata, 
		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |

			   IEEE80211_TX_INTFL_MLME_CONN_TX;

	ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,

			    elems.challenge - 2, elems.challenge_len + 2,

			    (void *)challenge,

			    challenge->datalen + sizeof(*challenge),

			    auth_data->bss->bssid, auth_data->bss->bssid,

			    auth_data->key, auth_data->key_len,

			    auth_data->key_idx, tx_flags);
@@ -3226,7 +3227,7 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata, 


	pos = mgmt->u.assoc_resp.variable;

	ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems,

			       mgmt->bssid, assoc_data->bss->bssid);

			       mgmt->bssid, NULL);



	if (!elems.supp_rates) {

		sdata_info(sdata, "no SuppRates element in AssocResp\n");
@@ -3301,6 +3302,7 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata, 
			sdata_info(sdata,

				   "AP bug: VHT operation missing from AssocResp\n");

		}

		kfree(bss_elems.nontx_profile);

	}



	/*
@@ -3578,7 +3580,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata, 


	pos = mgmt->u.assoc_resp.variable;

	ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems,

			       mgmt->bssid, assoc_data->bss->bssid);

			       mgmt->bssid, NULL);



	if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&

	    elems.timeout_int &&
@@ -3885,6 +3887,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata, 
		ifmgd->assoc_data->timeout = jiffies;

		ifmgd->assoc_data->timeout_started = true;

		run_again(sdata, ifmgd->assoc_data->timeout);

		kfree(elems.nontx_profile);

		return;

	}
@@ -4052,7 +4055,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata, 
		ieee80211_report_disconnect(sdata, deauth_buf,

					    sizeof(deauth_buf), true,

					    WLAN_REASON_DEAUTH_LEAVING);

		return;

		goto free;

	}



	if (sta && elems.opmode_notif)
@@ -4067,6 +4070,8 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata, 
					       elems.cisco_dtpc_elem);



	ieee80211_bss_info_change_notify(sdata, changed);

free:

	kfree(elems.nontx_profile);

}



void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,

net/mac80211/scan.c

+2 −0
Original line number Diff line number Diff line
@@ -216,6 +216,8 @@ ieee80211_bss_info_update(struct ieee80211_local *local, 
						rx_status, beacon);

	}



	kfree(elems.nontx_profile);



	return bss;

}

net/mac80211/util.c

+6 −5
Original line number Diff line number Diff line
@@ -1006,10 +1006,6 @@ _ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action, 
			} else

				elem_parse_failed = true;

			break;

		case WLAN_EID_CHALLENGE:

			elems->challenge = pos;

			elems->challenge_len = elen;

			break;

		case WLAN_EID_VENDOR_SPECIFIC:

			if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&

			    pos[2] == 0xf2) {
@@ -1367,6 +1363,11 @@ u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action, 
			cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,

					       nontransmitted_profile,

					       nontransmitted_profile_len);

		if (!nontransmitted_profile_len) {

			nontransmitted_profile_len = 0;

			kfree(nontransmitted_profile);

			nontransmitted_profile = NULL;

		}

	}



	crc = _ieee802_11_parse_elems_crc(start, len, action, elems, filter,
@@ -1396,7 +1397,7 @@ u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action, 
	    offsetofend(struct ieee80211_bssid_index, dtim_count))

		elems->dtim_count = elems->bssid_index->dtim_count;



	kfree(nontransmitted_profile);

	elems->nontx_profile = nontransmitted_profile;



	return crc;

}